HighCVE
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
The Hacker News·Source published ·1 min read·Video available
Advisory videoOpen on YouTube ↗
What happened?
Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches. "The exploit attempt originated from an IP address associated with a commercial anonymization network," CJ Moses,
Key details
- Amazon detected an exploit attempt on PHP2Shell vulnerabilities targeting its MadPot honeypot on Oct 17, 2026.
- The attempt came from an IP linked to a commercial anonymization network.
- Exploiting the bugs leaves virtually no digital evidence.
- Multiple threat actors appear involved, as indicated by varied payloads and anonymized infrastructure.
- CloudLinux published fixed packages for ea-php52 through ea-php85 and all alt-php versions.
Affected
- Every PHP core release in the 7.x and 8.x series is affected.
- All reachable PHP endpoints (forms, login routes, health checks) are at risk.
Fixes and mitigations
- Chainguard received the patch early, allowing immediate updates when disclosed.
- CloudLinux released fixed packages for ea-php52 through ea-php85 and all alt-php versions.
What to look for
- A single memory‑limit fatal error in the web server log is the only trace, often ignored as noise.
- No authentication bypass, session theft, or vulnerable endpoint discovery; logs show no anomalies.
- Unexpected PHP processes launching shells or downloading files should be monitored.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.